PT-2026-38588 · Github · Github Enterprise Server

Published 2026-05-07 · Updated 2026-05-10 · CVE-2026-6736

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21

Description An authentication bypass allows an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication is enabled, the 'signup' endpoint fails to properly enforce authentication restrictions, enabling account creation and session establishment without identity provider validation. The resulting account is limited to the default base permissions of the instance. Exploitation requires network access to an instance configured with an external authentication provider.

Recommendations Update to version 3.20.2, 3.19.6, 3.18.9, 3.17.15, or 3.16.18.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-6736

Affected Products

Github Enterprise Server

References · 9

• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6736 · Security Note
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18 · Vendor Advisory
• https://twitter.com/CVEnew/status/2053559190669418644 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052604475374801042 · Twitter Post
• https://t.me/CVEtracker/53040 · Telegram Post